Interactive Disassembler

Interactive Disassembler
Original author(s) Ilfak Guilfanov
Stable release
7.1[1] / February 27, 2018 (2018-02-27)
Written in C++[2]
Operating system Microsoft Windows, Mac OS X, and Linux
Available in English, Russian
Type Disassembler
License Proprietary
Website www.hex-rays.com/products/ida/index.shtml

The Interactive Disassembler (IDA) is a disassembler for computer software which generates assembly language source code from machine-executable code. It supports a variety of executable formats for different processors and operating systems. It also can be used as a debugger for Windows PE, Mac OS X Mach-O, and Linux ELF executables. A decompiler plug-in for programs compiled with a C/C++ compiler is available at extra cost. The latest full version of IDA Pro is commercial; while an earlier and less capable version is available for download free of charge (version 7.0 as of February 2018).[3]

IDA performs automatic code analysis, using cross-references between code sections, knowledge of parameters of API calls, and other information. However, the nature of disassembly precludes total accuracy, and a great deal of human intervention is necessarily required; IDA has interactive functionality to aid in improving the disassembly. A typical IDA user will begin with an automatically generated disassembly listing and then convert sections from code to data and vice versa, rename, annotate, and otherwise add information to the listing, until it becomes clear what it does.

Created as a shareware application by Ilfak Guilfanov, IDA was later sold as a commercial product by DataRescue, a Belgian company, who improved it and sold it under the name IDA Pro. In 2005, Guilfanov founded Hex-Rays to pursue the development of the Hex-Rays Decompiler IDA extension. In January 2008, Hex-Rays assumed the development and support of DataRescue's IDA Pro.[4]

Scripting

"IDC scripts" make it possible to extend the operation of the disassembler. Some helpful scripts are provided, which can serve as the basis for user written scripts. Most frequently scripts are used for extra modification of the generated code. For example, external symbol tables can be loaded thereby using the function names of the original source code. There are websites devoted to IDA scripts and offer assistance for frequently arising problems.

Users have created plugins that allow other common scripting languages to be used instead of, or in addition to, IDC. IdaRUB supports Ruby and IDAPython adds support for Python. As of version 5.4, IDAPython (dependent on Python 2.5) comes preinstalled with IDA Pro.

Supported systems/processors/compilers

  • System hosts
    • Windows x86 and ARM
    • Linux x86
    • Mac OS X x86
  • Recognized executable file formats
    • COFF and derivatives, including Win32/64/generic PE
    • ELF and derivatives (generic)
    • Mach-O (Mach)
    • NLM (NetWare)
    • LC/LE/LX (OS/2 3.x and various DOS extenders)
    • NE (OS/2 2.x, Win16, and various DOS extenders)
    • MZ (MS-DOS)
    • OMF and derivatives (generic)
    • AIM (generic)
    • raw binary, such as a ROM image or a COM file
  • Instruction sets
    • Intel 80x86 family
    • ARM architecture
    • Motorola 68k and H8
    • Zilog Z80
    • MOS 6502
    • Intel i860
    • DEC Alpha
    • Analog Devices ADSP218x
    • Angstrem KR1878
    • Atmel AVR series
    • DEC series PDP11
    • Fujitsu F2MC16L/F2MC16LX
    • Fujitsu FR 32-bit Family
    • Hitachi SH3/SH3B/SH4/SH4B
    • Hitachi H8: h8300/h8300a/h8s300/h8500
    • Intel 196 series: 80196/80196NP
    • Intel 51 series: 8051/80251b/80251s/80930b/80930s
    • Intel i960 series
    • Intel Itanium (ia64) series
    • Java virtual machine
    • MIPS: mipsb/mipsl/mipsr/mipsrl/r5900b/r5900l
    • Microchip PIC: PIC12Cxx/PIC16Cxx/PIC18Cxx
    • MSIL
    • Mitsubishi 7700 Family: m7700/m7750
    • Mitsubishi m32/m32rx
    • Mitsubishi m740
    • Mitsubishi m7900
    • Motorola DSP 5600x Family: dsp561xx/dsp5663xx/dsp566xx/dsp56k
    • Motorola ColdFire
    • Motorola HCS12
    • NEC 78K0/78K0S
    • PA-RISC
    • PowerPC
    • Xenon PowerPC Family
    • SGS-Thomson ST20/ST20c4/ST7
    • SPARC Family
    • Samsung SAM8
    • Siemens C166 series
    • TMS320Cxxx series
  • Compiler/libraries (for automatic library function recognition)[5]
    • Borland C++ 5.x for DOS/Windows
    • Borland C++ 3.1
    • Borland C Builder v4 for DOS/Windows
    • GNU C++ for Cygwin
    • Microsoft C
    • Microsoft QuickC
    • Microsoft Visual C++
    • Watcom C++ (16/32 bit) for DOS/OS2
    • ARM C v1.2
    • GNU C++ for Unix/common

Debugging

IDA Pro supports a number of debuggers,[6] including:

  • Remote Windows, Linux, and Mac applications (provided by Hex-Rays) allow running an executable in its native environment (presumably using a virtual machine for malware)
  • GNU Debugger (gdb) is supported on Linux and OS X, as well as the native Windows debugger
  • A Bochs plugin is provided for debugging simple applications (i.e., damaged UPX or mpress compacted executables)
  • An Intel PIN-based debugger
  • a trace replayer

References

  1. ↑ IDA: What's new in 7.1 (February 27, 2018)
  2. ↑ Hex-rays Home
  3. ↑ IDA Pro 7.0 Freeware version download
  4. ↑ "About Us". Hex-Rays. 27 February 2012. Retrieved 2 September 2013.
  5. ↑ "FLIRT Compiler Support". Hex-Rays.
  6. ↑ Eagle, Chris (2008). The IDA Pro Book: The Unofficial Guide to the World's Most Popular Disassembler. No Starch Press. ISBN 978-1-59327-178-7.

Further reading

  • Eilam, Eldad (2005). Reversing: Secrets of Reverse Engineering. Wiley Publishing. p. 595. ISBN 0-7645-7481-7.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.